App/API authentication approach advice - node.js

Question

I'm building a mobile app (Ionic/Cordova) and it will call an API (NodeJS) and I'm trying to come up with a simple and effective user authentication approach that can both:
Sign the user in to the mobile app and
Protect the API so that only a signed in user can call the API
The API can identify which user is calling it
Ideally, I'd use something like Auth0 to sign the user in to the app because I don't want to deal with passwords etc.
So I understand I can build my HTML5/Javascript app and using Auth0 and it will log the user into the app, but the part I'm trying to understand is how do I set it up so when user is logged in and their app calls the NodeJS API, the API code will know who the user is?
Can I just use the NodeJS passport module for Auth0 and just pass the tokens from the app to the API and like magic it will work? Or will I need to do something different in the API itself like build an oauth mechanism?
Any advice on how to protect the API in this scenario would be appreciated. I ideally don't want to build my own authentication/token system in the API.

Answer 1

Yes passport can help you to develop siple authnetication mechanism too. like username passoword. login once and stay logged in for some time.
check this tutorial
To get the tokem you have to add signin API. in the signin API you verify username and password. then generate a jwt token and pass to client.
var token = jwt.encode(user, config.secret);
Now In you mobile app At client side you can save as cookie or local storage .
window.localStorage.setItem('token', 'the-long-access-token');
Then after whenever you call API which are restricted. you pass the token. like this
var token = window.localStorage.getItem('token');
if (token) {
$.ajaxSetup({
headers: {
'x-access-token': token
}
});
}